"NO REST FOR THE WICKED, SO WE WON'T SLEEP EITHER": 0xQuit Shares New Details About Yuga Labs' Daring White Hat Operation That Saved $500,000 Worth Of NFTs!

As the Web3 world celebrates Yuga Labs' daring white hat operation that rescued 68 NFTs, including 29 Bored Apes, new details about how the exploit worked, how 0xQuit and CoffeeDev pulled off the rescue, and the damage already inflicted on collectors have begun to emerge.

On Sunday, Yuga Labs CEO Michael Figge announced that the company had executed a white hat operation on Flooring Protocol, an NFT liquidity platform where users deposit NFTs in exchange for fpTokens that represent fractional ownership of pooled assets.

 

The move came after an attacker discovered a vulnerability that allowed them to turn a tiny amount of WETH into an effectively infinite fpToken balance, which they then used to manipulate ownership records and drain the protocol's pools.

Following the rescue, Yuga Labs VP of Blockchain 0xQuit took to the timeline and explained that the exploit came down confusing the contract and ownership errors.

0xQuit explained, the attacker used a “malicious id that collided with a real NFT in the protocol’s packed accounting model” to trick Flooring Protocol into believing they were the real owner of NFTs, creating what he described as “ghost ownership.”

That false ownership allowed the attacker to mint a massive amount of fpTokens, which they then used to drain liquidity from the vulnerable pools

“At this point, a followup opportunist recognized what had happened and began scooping up value from the depleted pools by acquiring cheap tokens and exchanging them for underlying NFTs, which they then sold,” 0xQuit wrote. “After digging deeper, we found another related exploit path that could be used against additional vulnerable Flooring pools. At that point, waiting was not a responsible option. If we could identify a working path into more pools, another attacker could too…. So a whitehat rescue was on… I won’t dwell too much on the rescue contract itself, but it used the same broad bug class in a defensive capacity”

In the end, 0xQuit, CoffeeDev, and Yuga Labs saved more than $500,000 worth of NFTs from exploiters. But sadly, a lot of damage had already been done to the space.

According to 0xQuit, several NFTs were stolen and sold before the white hat rescue began, and Flooring Protocol remains unsafe tonight.

 

“The exploiters still hold more NFTs so I would not call this resolved, but as far as we can tell the NFTs that are vulnerable to theft have already been stolen,” he said. “It's important to NOT deposit any more NFTs into Flooring Protocol, as these could become immediately vulnerable. I'm glad that we were able to rally a team to rescue what we could, amounting to more than $500k worth of NFTs on a Sunday. It's no coincidence that these exploits tend to happen on weekends, when malicious actors know that less people are around to pay attention. So shout out to @coffeedev, @figge, @_PPMan_, and @GrailsOTC  for putting in the work. Thanks to  @HenryTheGrape  for bringing this to my attention in the first place. Thanks to all who DMd. No rest for the wicked, so we won't sleep either.”

 

This is a developing story. Stay tuned for updates!